Help us shape the future of Go! Take the 2026 Go Developer Survey

auth

package
v0.19.12 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 22, 2026 License: MIT Imports: 17 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func MarshalCredentials added in v0.19.1

func MarshalCredentials(order []string, byProvider map[string]*Credential) ([]byte, error)

MarshalCredentials matches upstream's JSON.stringify(data, null, 2) of auth.json.

func ParseCredentials added in v0.19.1

func ParseCredentials(data []byte) (map[string]*Credential, error)

ParseCredentials decodes auth.json content; empty content is an empty store (upstream parseStorageData), which self-heals a 0-byte file.

func SelectAnswer added in v0.19.1

func SelectAnswer(options []PromptOption, answer string) (string, error)

SelectAnswer maps a numbered choice (or a literal option id) to the option id auth flows expect.

Types

type APIKeyAuth

type APIKeyAuth interface {
	Name() string
	Resolve(context.Context, AuthContext, *Credential) (*AuthResult, error)
}

type APIKeyCheck

type APIKeyCheck interface {
	Check(context.Context, AuthContext, *Credential) (*AuthCheck, error)
}

type APIKeyLogin

type APIKeyLogin interface {
	Login(context.Context, AuthInteraction) (*Credential, error)
}

type AuthCheck

type AuthCheck struct {
	Source string         `json:"source,omitempty"`
	Type   CredentialType `json:"type"`
}

type AuthContext

type AuthContext interface {
	Env(context.Context, string) (string, bool)
	FileExists(context.Context, string) bool
}

type AuthEvent

type AuthEvent struct {
	Type             AuthEventType
	Message          string
	Links            []AuthInfoLink
	URL              string
	Instructions     string
	UserCode         string
	VerificationURI  string
	IntervalSeconds  int
	ExpiresInSeconds int
}

type AuthEventType

type AuthEventType string
const (
	EventInfo       AuthEventType = "info"
	EventAuthURL    AuthEventType = "auth_url"
	EventDeviceCode AuthEventType = "device_code"
	EventProgress   AuthEventType = "progress"
)
type AuthInfoLink struct {
	URL   string
	Label string
}

type AuthInteraction

type AuthInteraction interface {
	Prompt(context.Context, AuthPrompt) (string, error)
	Notify(AuthEvent)
}

type AuthPrompt

type AuthPrompt struct {
	Type        PromptType
	Message     string
	Placeholder string
	Options     []PromptOption
}

type AuthResult

type AuthResult struct {
	Auth   ModelAuth         `json:"auth"`
	Env    map[string]string `json:"env,omitempty"`
	Source string            `json:"source,omitempty"`
}

func ResolveProviderAuth

func ResolveProviderAuth(
	ctx context.Context,
	providerID string,
	methods ProviderAuth,
	credentials CredentialStore,
	authContext AuthContext,
	overrides *ResolutionOverrides,
) (*AuthResult, error)

type AuthType

type AuthType string
const (
	AuthTypeAPIKey AuthType = "api_key"
	AuthTypeOAuth  AuthType = "oauth"
)

type Credential

type Credential struct {
	Type    CredentialType
	Key     *string
	Env     map[string]string
	Refresh string
	Access  string
	Expires int64
	Extra   map[string]json.RawMessage
	// contains filtered or unexported fields
}

Credential retains unknown fields because auth.json is shared with TS pi and later provider OAuth flows attach provider-specific token metadata.

func APIKeyCredential

func APIKeyCredential(key string) *Credential

func APIKeyEnvCredential

func APIKeyEnvCredential(env map[string]string, envOrder ...string) *Credential

func OAuthCredential

func OAuthCredential(refresh, access string, expires int64) *Credential

func OAuthCredentialAccessFirst

func OAuthCredentialAccessFirst(access, refresh string, expires int64) *Credential

OAuthCredentialAccessFirst preserves the property insertion order used by providers whose upstream credential literals place access before refresh.

func (*Credential) Clone

func (credential *Credential) Clone() *Credential

func (Credential) MarshalJSON

func (credential Credential) MarshalJSON() ([]byte, error)

func (*Credential) SetExtra

func (credential *Credential) SetExtra(name string, value json.RawMessage)

func (*Credential) UnmarshalJSON

func (credential *Credential) UnmarshalJSON(data []byte) error

type CredentialInfo

type CredentialInfo struct {
	ProviderID string
	Type       CredentialType
}

type CredentialStore

type CredentialStore interface {
	Read(context.Context, string) (*Credential, error)
	List(context.Context) ([]CredentialInfo, error)
	Modify(context.Context, string, ModifyFunc) (*Credential, error)
	Delete(context.Context, string) error
}

CredentialStore is the upstream seam that lets applications own persistence.

func BindCredentialStore added in v0.7.1

func BindCredentialStore(ctx context.Context, store CredentialStore, provider string) (CredentialStore, error)

BindCredentialStore freezes a selectable store for one provider resolution. Ordinary stores pass through unchanged.

type CredentialType

type CredentialType string
const (
	CredentialAPIKey CredentialType = "api_key"
	CredentialOAuth  CredentialType = "oauth"
)

type EnvAPIKeyAuth

type EnvAPIKeyAuth struct {
	DisplayName string
	EnvVars     []string
}

func (EnvAPIKeyAuth) Login

func (method EnvAPIKeyAuth) Login(ctx context.Context, interaction AuthInteraction) (*Credential, error)

func (EnvAPIKeyAuth) Name

func (method EnvAPIKeyAuth) Name() string

func (EnvAPIKeyAuth) Resolve

func (method EnvAPIKeyAuth) Resolve(
	ctx context.Context,
	authContext AuthContext,
	credential *Credential,
) (*AuthResult, error)

type EnvironmentContext

type EnvironmentContext struct{}

func (EnvironmentContext) Env

func (EnvironmentContext) FileExists

func (EnvironmentContext) FileExists(_ context.Context, path string) bool

type Error

type Error struct {
	Code    ErrorCode
	Message string
	Cause   error
}

func (*Error) Error

func (authError *Error) Error() string

Error keeps the underlying cause in the surfaced message (upstream 4cf0a729): callers surface the message only, so a bare wrapper such as "OAuth refresh failed for openai-codex" would hide the provider response.

func (*Error) Unwrap

func (authError *Error) Unwrap() error

type ErrorCode

type ErrorCode string
const (
	ErrorModelSource     ErrorCode = "model_source"
	ErrorModelValidation ErrorCode = "model_validation"
	ErrorProvider        ErrorCode = "provider"
	ErrorStream          ErrorCode = "stream"
	ErrorAuth            ErrorCode = "auth"
	ErrorOAuth           ErrorCode = "oauth"
)

type JSONInteraction added in v0.19.1

type JSONInteraction struct {
	// contains filtered or unexported fields
}

JSONInteraction forwards a sign-in's events and prompts as JSON lines, for apps that draw their own screens, and takes one answer line per prompt from in until in closes, which cancels the prompts. Flows with a browser callback also prompt for a pasted code meanwhile; the callback winning cancels it.

func NewJSONInteraction added in v0.19.1

func NewJSONInteraction(ctx context.Context, in io.Reader, out *JSONLines) *JSONInteraction

NewJSONInteraction reads in until it closes or ctx ends.

func (*JSONInteraction) Notify added in v0.19.1

func (i *JSONInteraction) Notify(event AuthEvent)

func (*JSONInteraction) Prompt added in v0.19.1

func (i *JSONInteraction) Prompt(ctx context.Context, prompt AuthPrompt) (string, error)

type JSONLines added in v0.19.1

type JSONLines struct {
	// contains filtered or unexported fields
}

JSONLines encodes one JSON value per line, safe for concurrent emitters.

func NewJSONLines added in v0.19.1

func NewJSONLines(out io.Writer) *JSONLines

func (*JSONLines) Emit added in v0.19.1

func (o *JSONLines) Emit(v any)

type ModelAuth

type ModelAuth struct {
	APIKey  *string            `json:"apiKey,omitempty"`
	Headers map[string]*string `json:"headers,omitempty"`
	BaseURL *string            `json:"baseUrl,omitempty"`
}

type ModifyFunc

type ModifyFunc func(current *Credential) (*Credential, error)

type OAuth

type OAuth interface {
	Name() string
	Login(context.Context, AuthInteraction) (*Credential, error)
	Refresh(context.Context, *Credential) (*Credential, error)
	ToAuth(*Credential) (ModelAuth, error)
}

type OAuthLoginLabel

type OAuthLoginLabel interface {
	LoginLabel() string
}

type PromptOption

type PromptOption struct {
	ID          string
	Label       string
	Description string
}

type PromptType

type PromptType string
const (
	PromptText       PromptType = "text"
	PromptSecret     PromptType = "secret"
	PromptSelect     PromptType = "select"
	PromptManualCode PromptType = "manual_code"
)

type ProviderAuth

type ProviderAuth struct {
	APIKey APIKeyAuth
	OAuth  OAuth
}

type ResolutionOverrides

type ResolutionOverrides struct {
	APIKey           *string
	Env              map[string]string
	MinOAuthValidity *time.Duration
}

type Store added in v0.19.1

type Store struct {
	// contains filtered or unexported fields
}

Store keeps credentials in a document shaped like upstream's auth.json.

func NewDocumentStore added in v0.19.1

func NewDocumentStore(document document.Document) *Store

func NewMemoryStore

func NewMemoryStore(initial map[string]*Credential) *Store

func (*Store) Delete added in v0.19.1

func (store *Store) Delete(ctx context.Context, provider string) error

func (*Store) List added in v0.19.1

func (store *Store) List(ctx context.Context) ([]CredentialInfo, error)

func (*Store) Modify added in v0.19.1

func (store *Store) Modify(ctx context.Context, provider string, modify ModifyFunc) (result *Credential, err error)

func (*Store) Read added in v0.19.1

func (store *Store) Read(ctx context.Context, provider string) (*Credential, error)

type TextInteraction added in v0.19.1

type TextInteraction struct {
	// contains filtered or unexported fields
}

TextInteraction runs a sign-in on plain streams: links, codes and progress on out, prompts on errOut, one answer line per prompt on in.

func NewTextInteraction added in v0.19.1

func NewTextInteraction(in io.Reader, out, errOut io.Writer) *TextInteraction

func (*TextInteraction) Notify added in v0.19.1

func (interaction *TextInteraction) Notify(event AuthEvent)

func (*TextInteraction) Prompt added in v0.19.1

func (interaction *TextInteraction) Prompt(ctx context.Context, prompt AuthPrompt) (string, error)

Directories

Path Synopsis
Package accounts adds named credentials without changing the provider-keyed compatibility store.
Package accounts adds named credentials without changing the provider-keyed compatibility store.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL